summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Update for 2017.08.12017.08.1Peter Korsgaard2017-10-232-2/+36
| | | | Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* linux-headers: bump 4.{4, 9, 13}.x seriesBernd Kuhls2017-10-231-2/+2
| | | | | | | | [Peter: drop 4.13.x bump] Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit f7479f4c818f335332fdca128d7d4f3e5e7c02ac) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* sqlite: add security patchesBaruch Siach2017-10-232-0/+82
| | | | | | | | | | | | | | | | | CVE-2017-13685: The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and application crash) via a crafted file. CVE-2017-15286: SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false and a data structure is never initialized. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit d3c96bd5a6d3d64ab9c61104c6078b4bc89b12ec) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* libffi: add patch to fix MIPS supportMauro Condarelli2017-10-231-0/+37
| | | | | | | | | | | | | | | | | | | | | Building Python 3.x on MIPS with musl fails because the libffi code uses a "#ifdef linux" test to decide if we're building on Linux or not. When building with -std=c99, "linux" is not defined, so instead of including <asm/sgidefs.h>, libffi's code tries to include <sgidefs.h>, which doesn't exist on musl. The right fix is to use __linux__, which is POSIX compliant, and therefore defined even when -std=c99 is used. Note that glibc and uClibc were not affected because they do provide a <sgidefs.h> header in addition to the <asm/sgidefs.h> one. Signed-off-by: Mauro Condarelli <mc5686@mclink.it> [Thomas: reformat patch with Git, add a better commit log and description.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 4852f05907cd365825f37c283a415a77ba1fcba9) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* Add DEPENDENCIES_HOST_PREREQ to the list of packagesAlfredo Alvarez Fernandez2017-10-231-0/+2
| | | | | | | | | | | That way packages included in that list like ccache will also be regarded as a normal packages for targets like external-deps, show-targets or legal-info Signed-off-by: Alfredo Alvarez Fernandez <alfredo.alvarez_fernandez@nokia.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> (cherry picked from commit 862b76cfefc101943f09db2a73f5519f9a5bb2cb) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* dependencies: always use HOSTCC_NOCACHE for DEPENDENCIES_HOST_PREREQAlfredo Alvarez Fernandez2017-10-231-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Currently, HOSTCC and HOSTCXX are set to their _NOCACHE variants in the 'dependencies' target. This is needed because at that time, ccache is not built yet - host-ccache is one of the dependencies. However, because this override is only specified for the 'dependencies' target (and thereby gets inherited by its dependencies), the override is only applied when the package is reached through the 'dependencies' target. This is not the case when one of DEPENDENCIES_HOST_PREREQ is built directly from the command line, e.g. when doing 'make host-ccache'. So in that case, ccache will be built with ccache... which fails of course. To fix this, directly apply the override to the DEPENCIES_HOST_PREREQ targets. Note that this only fixes the issue for 'make host-ccache', NOT for e.g. 'make host-ccache-configure'. Signed-off-by: Alfredo Alvarez Fernandez <alfredo.alvarez_fernandez@nokia.com> [Arnout: improve commit message] Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> (cherry picked from commit 36d398ac30f35ca9d4405a9dee2b33560ec3595d) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* xen: add upstream post-4.9.0 security fix for XSA-245Peter Korsgaard2017-10-232-1/+6
| | | | | | | | | | | | | Fixes XA-245: ARM: Some memory not scrubbed at boot https://xenbits.xenproject.org/xsa/advisory-245.html Notice: Not applying XSA-237..244 as they are x86 only and have patch file name conflicts between 2017.02.x and master. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 90b9b457ecd5e6ebea9d48f36c030b95ca67059b) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* lame: security bump to version 3.100Peter Korsgaard2017-10-235-308/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues: CVE-2017-9410: fill_buffer_resample function in libmp3lame/util.c heap-based buffer over-read and ap CVE-2017-9411: fill_buffer_resample function in libmp3lame/util.c invalid memory read and application crash CVE-2017-9412: unpack_read_samples function in frontend/get_audio.c invalid memory read and application crash Drop patches now upstream or no longer needed: 0001-configure.patch: Upstream as mentioned in patch description 0002-gtk1-ac-directives.patch: Upstream as mentioned in patch description/release notes: Resurrect Owen Taylor's code dated from 97-11-3 to properly deal with GTK1. This was transplanted back from aclocal.m4 with a patch provided by Andres Mejia. This change makes it easy to regenerate autotools' files with a simple invocation of autoconf -vfi. 0003-msse.patch: Not needed as -march <x86-variant-with-msse-support> nowadays implies -msse. With these removed, autoreconf is no longer needed. Also add a hash for the license file while we're at it. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 7e3583dd558925a447eaa4367d659f39482fbbc0) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* busybox: add upstream post-1.27.2 httpd fixPeter Korsgaard2017-10-231-0/+27
| | | | | | Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit ec58149009776f63767644f9a3409f420c271766) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* busybox: bump to version 1.27.2Adam Duskett2017-10-232-4/+4
| | | | | | | Signed-off-by: Adam Duskett <aduskett@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 5cdb463e442d63f0ba361e7348d0ed56cb9b63d0) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* musl: add upstream security fix for CVE-2017-15650Peter Korsgaard2017-10-231-0/+35
| | | | | | | | | | | | | | | | | | | | >From the upstream announcement: http://www.openwall.com/lists/oss-security/2017/10/19/5 Felix Wilhelm has discovered a flaw in the dns response parsing for musl libc 1.1.16 that leads to overflow of a stack-based buffer. Earlier versions are also affected. When an application makes a request via getaddrinfo for both IPv4 and IPv6 results (AF_UNSPEC), an attacker who controls or can spoof the nameservers configured in resolv.conf can reply to both the A and AAAA queries with A results. Since A records are smaller than AAAA records, it's possible to fit more addresses than the precomputed bound, and a buffer overflow occurs. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 209f42fd3a5f4357e22fb72f1597a6868566aabd) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/go: fix cross-compilation settingsAngelo Compagnucci2017-10-231-6/+8
| | | | | | | | | | | | | | | This patch fixes a bug with the BR2_TOOLCHAIN_HAS_THREADS variable handling which causes CGO_ENABLED to be always 0. Furthermore, it fixes the cross compilation options for the go compiler: setting CGO_ENABLED should be done only for the target compiler not the host one. Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Acked-by: Christian Stewart <christian@paral.in> (cherry picked from commit 80ea21bc3c2147adf810731b0b242e94a3ad294e) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* webkitgtk: security bump to version 2.18.1Adrian Perez de Castro2017-10-232-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | This is a maintenance release of the current stable WebKitGTK+ version, which contains bugfixes (many of them related to rendering, plus one important fix for touch input) and many security fixes. Release notes: https://webkitgtk.org/2017/10/18/webkitgtk2.18.1-released.html Fixes CVE-2017-7081, CVE-2017-7087, CVE-2017-7089, CVE-2017-7090, CVE-2017-7091, CVE-2017-7092, CVE-2017-7093, CVE-2017-7094, CVE-2017-7095, CVE-2017-7096, CVE-2017-7098, CVE-2017-7099, CVE-2017-7100, CVE-2017-7102, CVE-2017-7104, CVE-2017-7107, CVE-2017-7109, CVE-2017-7111, CVE-2017-7117, CVE-2017-7120, CVE-2017-7142: https://webkitgtk.org/security/WSA-2017-0008.html Signed-off-by: Adrian Perez de Castro <aperez@igalia.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 6d623e72770534c8e40e5afd7aa8fb77e49d1974) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* webkitgtk: update to version 2.18.0Adrian Perez de Castro2017-10-238-354/+11
| | | | | | | | | | | | | | | | | | | | | | Release notes: https://webkitgtk.org/2017/09/11/webkitgtk2.18.0-released.html No corresponding WebKit Security Advisory (WSA) has been published. All patches have been applied upstream. This also bumps the required target GCC version, due to the WebKit code now using more modern C++ features which were introduced in version 5.x of the compiler. Signed-off-by: Adrian Perez de Castro <aperez@igalia.com> [Arnout: - propagate dependency to midori; - mention in commit message why patches were removed.] Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> (cherry picked from commit 905b1ab5c21f39f9cd1777f6d5745c90d863da4b) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* Config.in: fix help comment for gcc optimizationLothar Felten2017-10-231-1/+2
| | | | | | | | | | | The default for is set to BR2_OPTIMIZE_S, the help comment designated BR2_OPTIMIZE_0 as default. Changed the help comment to show that BR2_OPTIMIZE_S is the default. Signed-off-by: Lothar Felten <lothar.felten@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 4e09fd8bdef6ddea1097f91df07515abde389cd0) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* linux-headers: bump 4.{1, 4, 9, 13}.x seriesBernd Kuhls2017-10-221-3/+3
| | | | | | | | [Peter: drop 4.13.x bump] Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 60e3da602d3d5b017b5176848abcba92866df3f3) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* wpa_supplicant: fix upstream URLAlexander Mukhin2017-10-192-2/+2
| | | | | | | | | | wpa_supplicant project URL has been changed to w1.fi/wpa_supplicant. The old domain epitest.fi has expired. Signed-off-by: Alexander Mukhin <alexander.i.mukhin@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 38e36cd0e1ec55743766e48564d952e38ff40113) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* wpa_supplicant: add upstream security fixesPeter Korsgaard2017-10-192-0/+15
| | | | | | | | | | | | | Fixes CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088: http://lists.infradead.org/pipermail/hostap/2017-October/037989.html [Peter: also add patch 0001 as suggested by Jörg Krause] Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 57c0a485cc0a5681e772ddaf1c886e810d3d7ae4) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* hostapd: add upstream security fixesPeter Korsgaard2017-10-192-0/+5
| | | | | | | | | | Fixes CVE-2017-13082 http://lists.infradead.org/pipermail/hostap/2017-October/037989.html Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 5259c5c8058aa2c9608fd202c35477015a41c326) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* hostapd: fix upstream URLAlexander Mukhin2017-10-192-2/+2
| | | | | | | | | | hostapd project URL has been changed to w1.fi/hostapd. The old domain epitest.fi has expired. Signed-off-by: Alexander Mukhin <alexander.i.mukhin@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 8a2396b90aeb411a856335d976a427eed6e115bc) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* Update github hashesGary Bisson2017-10-172-2/+2
| | | | | | | | | | | Based on Bernd patch (commit 4fbc0c9b) which is available on master branch. The kernel-module-imx-gpu-viv and rpi-userland packages are actually broken on 2017.08 so this is a partial backport Bernd patch. Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* bzip2: fix passing of TARGET_MAKE_ENV to makeLuca Ceresoli2017-10-171-2/+2
| | | | | | | | | | TARGET_MAKE_ENV is not passed to make because it is on a different line without a backslash. Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 7690bc03358b7460aa138f785b3a5704b919882a) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* linux-headers: bump 3.2.x and 4.{4, 9, 13}.x seriesFabio Estevam2017-10-171-3/+3
| | | | | | | | [Peter: drop 4.13.x bump] Signed-off-by: Fabio Estevam <festevam@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 2cd4c845865ca86ee3d7b015670063b347cb49f8) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* libnss: security bump to version 3.33Peter Korsgaard2017-10-172-3/+5
| | | | | | | | | | | | | | | | Fixes CVE-2017-7805 - Martin Thomson discovered that nss, the Mozilla Network Security Service library, is prone to a use-after-free vulnerability in the TLS 1.2 implementation when handshake hashes are generated. A remote attacker can take advantage of this flaw to cause an application using the nss library to crash, resulting in a denial of service, or potentially to execute arbitrary code. Also add a hash for the license file while we're at it. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 746502418fbf603464efe0dfc77c6bc10b10603e) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* libnspr: bump version to 4.17Peter Korsgaard2017-10-172-3/+5
| | | | | | | | | | | libnss 3.33 needs libnspr >= 4.17. Also add a hash for the license file while we're at it. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit b1363093248b6198eab285124b2c87411155a0a1) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/x11r7/xserver_xorg-server: security bump version to 1.19.5Bernd Kuhls2017-10-175-7/+7
| | | | | | | | | | | | | | | | | | | Fixes xfixes: unvalidated lengths (CVE-2017-12183) Xi: fix wrong extra length check in ProcXIChangeHierarchy (CVE-2017-12178) dbe: Unvalidated variable-length request in ProcDbeGetVisualInfo (CVE-2017-12177) Unvalidated extra length in ProcEstablishConnection (CVE-2017-12176) Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit e7713abf89f3fa3ab773813a10b61080471f5bcb) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* docs/manual: fix BR2_EXTERNAL path typoCam Hutchison2017-10-171-2/+2
| | | | | | | Signed-off-by: Cam Hutchison <camh@xdna.net> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 0c76d89e54705a477cedad5dc39b668af771be7d) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* ifupdown-scripts: do not install .empty filesCam Hutchison2017-10-171-1/+1
| | | | | | | | | | | | | | | ifupdown-scripts has some .empty files to maintain empty directories in git. Previously this package used to be part of the skeleton which used SYSTEM_RSYNC to copy the directories to the target. When it was split into a separate package, cp -a was used to do the copy instead, which copies the .empty files. Change to SYSTEM_RSYNC which excludes .empty files. Signed-off-by: Cam Hutchison <camh@xdna.net> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 58b74e0dbf9b22d7dbc11127c29e23e234a9e8cf) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* support/kconfig: fix usage typo and align verb tensesThomas De Schampheleire2017-10-172-2/+2
| | | | | | | | | | Fix typo 'selectes' -> 'selects'. Additionally, change 'will exclude' to 'excludes' to align with 'selects'. Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 787f4fee7184e4b86343a1d6d60c303622d458b9) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* xlib_libXfont{, 2}: add upstream security fixesPeter Korsgaard2017-10-174-0/+172
| | | | | | | | | | | | | Fixes the following security issues: CVE-2017-13720 - Check for end of string in PatternMatch CVE-2017-13722 - pcfGetProperties: Check string boundaries Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 46a54b6464d09edc36ae0d1d041f89ffd77b3ea1) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nginx/S50nginx: Do not assume start-stop-daemon knows -R.Thomas Claveirole2017-10-171-4/+2
| | | | | | | | | | | | | | start-stop-daemon fails on -R when not compiled with CONFIG_FEATURE_START_STOP_DAEMON_FANCY. Thus, do not rely on -R during stop to avoid a race condition during restart. Use a sleep 1 during restart instead, as suggested by Peter Korsgaard in <87bmluk4bm.fsf@dell.be.48ers.dk>. Signed-off-by: Thomas Claveirole <thomas.claveirole@green-communications.fr> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 99b8044a6714e925c504c0e3fc46f3730e0fe572) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* musl: add patch to fix build on ARMv4 with new binutilsTimothy Lee2017-10-171-0/+43
| | | | | | | | | | | | New binutils (since 2.27.51) cannot build musl-1.1.16 due to breakage in ARMv4 atomics asm. This patch from upstream musl repository is needed until musl-1.1.17 is released: https://git.musl-libc.org/cgit/musl/commit/?id=b261a24256792177a5f0531dbb25cc6267220ca5 Signed-off-by: Timothy Lee <timothy.ty.lee@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 27cf2d3baf879f7314f12787982d8f4a5b4218cf) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/iucode-tool: security bump to version 2.2Bernd Kuhls2017-10-172-3/+3
| | | | | | | | | | | | | | | | Version 2.1.1 fixed CVE-2017-0357: https://gitlab.com/iucode-tool/iucode-tool/commit/657ce44ac462bcec35a3e12f9e7f53ca92ae62b7 Dropped IUCODE_TOOL_CONF_ENV after version 2.2 added a configure check for libargp: https://gitlab.com/iucode-tool/iucode-tool/commit/b14bed6771e7ab48371b272a0c68dd017767142a Added hash for license file. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 1462c07914f5e53cb7816ad86abee3e31b2bc1b6) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/x11r7/xserver_xorg-server: rename patch directory after the last ↵Romain Naour2017-10-177-205/+0
| | | | | | | | | | | | | | | | | | | | version bump The last bump [1] forgot to rename the patch directory and remove upstream patches. We still need to fix the monotonic clock check which doesn't work when cross-compiling. [1] 436659c55f8d3c6155546cfc666a13c793d992f9 Signed-off-by: Romain Naour <romain.naour@gmail.com> Cc: Bernd Kuhls <bernd.kuhls@t-online.de> Cc: Peter Korsgaard <peter@korsgaard.com> Acked-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 7cf8a08feb67052d9b3502dbdcbeaeda26b55665) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* libressl: fix musl build with older kernel headersBaruch Siach2017-10-171-0/+38
| | | | | | | | | | | | | | | | | | | | | | | | | musl provides its own SYS_getrandom definition, but not GRND_NONBLOCK. This breaks the build with kernel headers older than v3.17. Add a patch adding a local definition of GRND_NONBLOCK to fix the build. The following defconfig reproduces the build failure: BR2_x86_pentium_mmx=y BR2_TOOLCHAIN_BUILDROOT_MUSL=y BR2_KERNEL_HEADERS_3_12=y BR2_PACKAGE_LIBRESSL=y The getentropy_linux.c file is in upstream tarball, but not in its git repository. It originates from OpenBSD. For this reason the patch is against the tarball, but not git formatted. Cc: Adam Duskett <aduskett@gmail.com> Signed-off-by: Baruch Siach <baruch@tkos.co.il> [Arnout: change filename to correspond to how git creates it] Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> (cherry picked from commit 7adc268b58a1eea9967ed5c7a3b7b4471575d73a) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/x11r7/xserver_xorg-server: security bump to version 1.19.4Bernd Kuhls2017-10-172-3/+6
| | | | | | | | | | | | Fixes CVE-2017-13721 & CVE-2017-13723: https://lists.x.org/archives/xorg-announce/2017-October/002809.html Added all hashes provided by upstream. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 436659c55f8d3c6155546cfc666a13c793d992f9) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* libcurl: security bump to version 7.56.0Peter Korsgaard2017-10-173-45/+3
| | | | | | | | | | | | Drop upstreamed patch. Fixes CVE-2017-1000254 - FTP PWD response parser out of bounds read: https://curl.haxx.se/docs/adv_20171004.html Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 9d95b93e5d36442979cdff7a9f3ee10b1eb9e0c7) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* qemu: change to .tar.xz formatPeter Korsgaard2017-10-172-3/+3
| | | | | | | | | And use the official download location. Suggested-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit b79547014d0cdbf34aa4112a464a63f9e865b9ce) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* qemu: security bump to version 2.8.1.1Peter Korsgaard2017-10-172-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues and adds a number of other bigfixes: 2.8.1: Changelog: https://lists.gnu.org/archive/html/qemu-devel/2017-03/msg06332.html CVE-2017-2615 - display: cirrus: oob access while doing bitblt copy backward mode CVE-2017-2620 - display: cirrus: out-of-bounds access issue while in cirrus_bitblt_cputovideo CVE-2017-2630 - nbd: oob stack write in client routine drop_sync 2.8.1.1 Changelog: https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg03460.html CVE-2017-7471 - 9p: virtfs allows guest to change filesystem attributes on host Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit af0f2d2bbcaca9000e62b5388f4c3cd8e700c6ff) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* qemu: drop obsolete "--disable-uuid" configuration parameterCarlos Santos2017-10-171-1/+0
| | | | | | | | | | ./configure: --disable-uuid is obsolete, UUID support is always built Change-Id: I9e278418d19e15bbbd3ea233658cd62f75e3385c Signed-off-by: Carlos Santos <casantos@datacom.ind.br> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit f911406f4f36cb6be4bc82d7faae1a3c4f07fc59) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* vboot-utils: disable static futilityAlex Suykov2017-10-171-0/+30
| | | | | | | | | | | | | Possibly fixes http://autobuild.buildroot.net/results/fbe/fbe7892539cc1bf18f89d18c6609a5aa747647d0/ http://autobuild.buildroot.net/results/4bc/4bc388618ff02dde26ae09db021434a936c8cc1b/ and similar errors. Signed-off-by: Alex Suykov <alex.suykov@gmail.com> Tested-by: Matt Weber <matthew.weber@rockwellcollins.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> (cherry picked from commit 3c10ba4b1eba589096447cce9b77191dc2d8388d) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/tor: fix openssl detection for static buildsBernd Kuhls2017-10-171-1/+6
| | | | | | | | | | | | | | | | | Fixes http://autobuild.buildroot.net/results/8e6/8e639ab8912e7d884fd8e6dbb1ca8b49451dd766/ /home/test/autobuild/run/instance-1/output/host/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib/libcrypto.a(c_zlib.o): In function `zlib_stateful_expand_block': c_zlib.c:(.text+0x54): undefined reference to `inflate' /home/test/autobuild/run/instance-1/output/host/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib/libcrypto.a(c_zlib.o): In function `zlib_stateful_compress_block': c_zlib.c:(.text+0xd4): undefined reference to `deflate' Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> (cherry picked from commit d2268adf5b9e19fba6094f53e397168c8a4b8abb) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* HOST_DIR/lib: symlink respectively to lib32/64Matt Weber2017-10-171-1/+8
| | | | | | | | | | | | | | | | | | Discovered the issue on a RHEL7.4 machine where the cmake build dynamically selected HOST_DIR/lib64 as the installation path for the lzo2 library. Fixes failures like the following: host-mtd http://autobuild.buildroot.net/results/d31/d31581d2e60f35cf70312683df99c768e2ea8516/ host-squashfs http://autobuild.buildroot.net/results/d9c/d9c95231ac774ed71580754a15ebb3b121764310/ Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> (cherry picked from commit 5ad679c8a8369f27df7080e678f9b004bf9d9647) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* linux-headers: bump 4.{4, 9, 13}.x seriesBernd Kuhls2017-10-171-2/+2
| | | | | | | | [Peter: drop 4.13.x bump] Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> (cherry picked from commit 55a6159dcd86da23f6ca36318e3ec8d17bdb7460) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* qt: Allow enabling of QtWebKit with GCC 6+Evgeniy Didin2017-10-171-0/+50
| | | | | | | | | | | | | | | | | | | Building Qt with QtWebKit on configuration step there is a check which disables QtWebKit build with GCC 6+. Back in the day nobody thought about building Qt with GCC version greater than 5.x. And now with modern GCCs like 6.x and 7.x this assumption gets in the way. Given in Buildroot today we don't have GCC older than 4.9 it should be safe to remove now meaningless check completely by adding patch to qt. Signed-off-by: Evgeniy Didin <didin@synopsys.com> Cc: Alexey Brodkin <abrodkin@synopsys.com> Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit f95bb8562ef02935d6fcf9b254060454e5be796c) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* dnsmasq: security bump to version 2.78Baruch Siach2017-10-172-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Supported Lua version is now 5.2. Add licenses hash. Fixes a number of security issues: CVE-2017-13704 - Crash when DNS query exceeded 512 bytes (a regression in 2.77, so technically not fixed by this bump) CVE-2017-14491 - Heap overflow in DNS code CVE-2017-14492 - Heap overflow in IPv6 router advertisement code CVE-2017-14493 - Stack overflow in DHCPv6 code CVE-2017-14494 - Information leak in DHCPv6 CVE-2017-14496 - Invalid boundary checks allows a malicious DNS queries to trigger DoS CVE-2017-14495 - Out-of-memory Dos vulnerability Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit e77fdc90e320ff38d56d8e5c97fc783e8fbb76bb) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/urg: fix extraction commandsYann E. MORIN2017-10-171-4/+1
| | | | | | | | | | | | | | | | Currently, the extraction commands entirely remove the urg directory, which means the downloaded stamp will get removed, and thus a subsequent build would try to re-download it. It turns out that the directory extracted by urg is already correctly named, so we just need to extract out of the build directory. This highly simplifies the command. Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Cc: Samuel Martin <s.martin49@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 9e943e852286d1f3f14b7f55e96c1e550affe571) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/supertuxkart: needs freetypeBernd Kuhls2017-10-172-0/+2
| | | | | | | | | | | | | | | | | | | | | | | https://github.com/supertuxkart/stk-code/blob/master/CMakeLists.txt#L231 Build would fail without this patch using this defconfig: BR2_x86_64=y BR2_TOOLCHAIN_BUILDROOT_LOCALE=y BR2_TOOLCHAIN_BUILDROOT_CXX=y BR2_PACKAGE_SUPERTUXKART=y BR2_PACKAGE_MESA3D=y BR2_PACKAGE_MESA3D_DRI_DRIVER_I965=y BR2_PACKAGE_MESA3D_OPENGL_EGL=y BR2_PACKAGE_XORG7=y Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Acked-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar> Acked-by: Romain Naour <romain.naour@gmail.com> Tested-by: Romain Naour <romain.naour@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit ffcaf9158c1619d83091e3c3f3bf58181c8d70dd) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* zsh: disable NIS supportBaruch Siach2017-10-171-0/+1
| | | | | | | | | | | | | | | | The configure test for NIS and NIS+ looks for the ypcat and nisls host utilities, respectively. This is not compatible with cross compilation. Disable both unconditionally. Fixes: http://autobuild.buildroot.net/results/54c/54c9c5dff3df0a43573b03896cb0629fcae08478/ http://autobuild.buildroot.net/results/c8e/c8e30a1eb6e77ae76292b6a01bede5abb2b1b7b7/ Cc: Phil Eichinger <phil.eichinger@gmail.com> Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 4a4f99a428f3c49aa80440325db33485777e8f69) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* ejabberd: Replace $(HOST_DIR) to /usr in ERL pathJohan Oudinet2017-10-171-2/+2
| | | | | | | | | | | | Previously, it was working by luck. Buildroot has fixed its definition of HOST_DIR and pkg-autotools.mk uses the classical /usr prefix. So, fix this sed expression to correctly replace $(HOST_DIR) by /usr in ERL path. Signed-off-by: Johan Oudinet <johan.oudinet@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit e6156615ecfb59d71aa5875fc206e4f1da80aec5) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
OpenPOWER on IntegriCloud